{"id":53560,"date":"2019-12-04T00:00:00","date_gmt":"2019-12-03T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/15-uyazvimostej-v-usb-drajverah-postavlyaemyh-v-yadre-linux"},"modified":"2020-02-18T14:01:28","modified_gmt":"2020-02-18T11:01:28","slug":"15-uyazvimostej-v-usb-drajverah-postavlyaemyh-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/15-uyazvimostej-v-usb-drajverah-postavlyaemyh-v-yadre-linux","title":{"rendered":"15 s\u00e5rbarheter i USB-drivrutiner som ing\u00e5r i Linux-k\u00e4rnan","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Konovalov<\/a><\/noindex> fr\u00e5n Google publicerade<\/a><\/noindex> rapport om uppt\u00e4ckten av ytterligare 15 s\u00e5rbarheter (CVE-2019-19523 \u2013 CVE-2019-19537) i USB-drivrutiner som erbjuds i Linux-k\u00e4rnan. Detta \u00e4r den tredje omg\u00e5ngen problem som uppt\u00e4ckts vid fuzzing-testning av USB-stacken i paketet syzkaller<\/a><\/noindex> \u2013 tidigare denna forskare redan<\/a><\/noindex> rapporterat<\/a><\/noindex> om 29 s\u00e5rbarheter. <\/p>\n

Denna g\u00e5ng inkluderar listan endast s\u00e5rbarheter orsakade av tillg\u00e5ng till redan frigjorda minnesomr\u00e5den (use-after-free) eller som leder till datal\u00e4ckage fr\u00e5n k\u00e4rnminnet. Problem som kan anv\u00e4ndas f\u00f6r tj\u00e4nsteavbrott ing\u00e5r inte i rapporten. S\u00e5rbarheterna kan potentiellt utnyttjas n\u00e4r specifikt f\u00f6rberedda USB-enheter ansluts till datorn. Korrigeringar f\u00f6r alla problem som n\u00e4mns i rapporten har redan inkluderats i k\u00e4rnan, men n\u00e5gra som inte ingick i rapporten fel<\/a><\/noindex> f\u00f6rblir fortfarande okorrigerade.<\/p>\n

De farligaste s\u00e5rbarheterna av typen \u201euse-after-free\u201c, som kan leda till att en angripares kod k\u00f6rs, har \u00e5tg\u00e4rdats i drivrutinerna adutux, ff-memless, ieee802154, pn533, hiddev, iowarrior, mcba_usb och yurex. Under CVE-2019-19532 har ytterligare 14 s\u00e5rbarheter i HID-drivrutinerna reduserats, orsakade av fel som till\u00e5ter skrivning utanf\u00f6r buffertens gr\u00e4nser (out-of-bounds write). I drivrutinerna ttusb_dec, pcan_usb_fd och pcan_usb_pro har problem uppt\u00e4ckts som leder till datal\u00e4ckage fr\u00e5n k\u00e4rnminnet. I koden f\u00f6r USB-stacken f\u00f6r arbete med teckenst\u00e4llda enheter har ett problem identifierats (CVE-2019-19537), orsakad av ett t\u00e4vlingsf\u00f6rh\u00e5llande (race condition).<\/p>\n

Det kan ocks\u00e5 noteras
\nidentifiering<\/a><\/noindex> fyra s\u00e5rbarheter (CVE-2019-14895, CVE-2019-14896, CVE-2019-14897, CVE-2019-14901) i drivrutinen f\u00f6r Marvell tr\u00e5dl\u00f6sa chip, som kan leda till buffert\u00f6verfl\u00f6d. Attacken kan utf\u00f6ras p\u00e5 distans genom att skicka s\u00e4rskilt formaterade paket n\u00e4r man ansluter till en angripares tr\u00e5dl\u00f6sa hotspot. Den mest troliga hoten \u00e4r ett avbrott p\u00e5 distans (k\u00e4rnkrash), men m\u00f6jligheten f\u00f6r kodk\u00f6rning i systemet kan inte uteslutas.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u0445 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2019-19523 — CVE-2019-19537) \u0432 USB-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0445 \u0432 \u044f\u0434\u0440\u0435 Linux. \u042d\u0442\u043e \u0442\u0440\u0435\u0442\u044c\u044f \u043f\u043e\u0440\u0446\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 fuzzing-\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f USB-\u0441\u0442\u0435\u043a\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 syzkaller — \u0440\u0430\u043d\u0435\u0435 \u0434\u0430\u043d\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0436\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u043b \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 29 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53560","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4715 s\u00e5rbarheter i USB-drivrutiner som levereras i Linux-k\u00e4rnan | ProHoster","description":"Andrej Konovalov fr\u00e5n Google","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/15-uyazvimostej-v-usb-drajverah-postavlyaemyh-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4715 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 USB-\u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u0445, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043d\u043e\u0432\u0430\u043b\u043e\u0432 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Google","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/15-uyazvimostej-v-usb-drajverah-postavlyaemyh-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-03T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53560","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:52:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:20:02","updated":"2026-01-24 07:52:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53560","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=53560"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/53560\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=53560"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=53560"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=53560"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}